computer: document the second reason a pull skips

SkippedEntry became a union of two reasons when the per-command
write capability landed: an entry can be refused because it targets
a read-only mount root, or because the command ran without write
access and the post-command pull refused everything it was offered.

The comments on ExecResult.skipped and Workspace.pull still
described only the mount case, and ExecResult went further and
claimed the field is empty when no read-only mounts are registered.
That is wrong for a container command that ran read-only. Describe
both reasons, and note that a backend sharing the workspace store
never fills the field because it has no pull to refuse.

Author: Antoni T

packages/computer/src/shell.ts

@@ -55,10 +55,13 @@ export interface ExecResult<E extends ExecEncoding = undefined> {
   // VFS sync stats from the docs/05 bracket.
   //   pushed  — entries shipped by the pre-exec pushOnce.
   //   pulled  — entries the post-drain pullOnce applied locally.
-  //   skipped — entries the post-drain pullOnce did NOT apply
-  //             because they targeted a read-only mount root.
-  //             Empty when no read-only mounts are registered or
-  //             the container stayed clear of them.
+  //   skipped — entries the post-drain pullOnce did not apply,
+  //             either because they targeted a read-only mount
+  //             root or because the command ran without write
+  //             access and the pull refused everything it was
+  //             offered. Always empty for a backend that shares
+  //             the workspace store: there is no pull to refuse,
+  //             and a write fails inside the command instead.
   // pushed is observed before the stream is returned. The remaining
   // fields describe the post-command pull when result() is used.
   pushed: number;

packages/computer/src/workspace.ts

@@ -626,7 +626,8 @@ export class Workspace {
   // pull() returns the dofs ApplyResult { applied, skipped } —
   // `applied` is the number of entries written into the local
   // store, `skipped` surfaces remote-side writes the apply path
-  // rejected because they targeted a read-only mount root.
+  // rejected, either because they targeted a read-only mount root
+  // or because the pull ran without write access.
   //
   // Both methods emit a `workspace.sync.push` / `workspace.sync.pull`
   // span on the configured observer, tagged with the resolved